Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection

🗓️ 28 May 2026 17:22:36Reported by GitHub Advisory DatabaseType

Symfony Mailjet and LOX24 webhook parsers did not verify secrets, enabling unauthenticated events.

Reporter	Title	Published	Views	Family All 15
Circl	CVE-2026-45754	20 May 202611:01	–	circl
CVE	CVE-2026-45754	1 Jan 197000:00	–	cve
Debian	[SECURITY] [DSA 6312-1] symfony security update	31 May 202612:26	–	debian
Debian CVE	CVE-2026-45754	1 Jan 197000:00	–	debiancve
Tenable Nessus	Debian dsa-6312 : php-symfony - security update	1 Jun 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-45754	21 May 202600:00	–	nessus
Friends Of PHP	CVE-2026-45754: Mailjet Mailer and LOX24 Notifier Webhook Parsers Never Verify the Configured Secret: Unauthenticated Webhook Event Injection	1 Jan 197000:00	–	friendsofphp
Friends Of PHP	CVE-2026-45754: Mailjet Mailer and LOX24 Notifier Webhook Parsers Never Verify the Configured Secret: Unauthenticated Webhook Event Injection	1 Jan 197000:00	–	friendsofphp
Friends Of PHP	CVE-2026-45754: Mailjet Mailer and LOX24 Notifier Webhook Parsers Never Verify the Configured Secret: Unauthenticated Webhook Event Injection	1 Jan 197000:00	–	friendsofphp
OSV	DEBIAN-CVE-2026-45754	21 May 202605:48	–	osv

Vulners

Node

symfony mailjet-mailerRange8.0.0–8.0.12composer

symfony mailjet-mailerRange7.0.0–7.4.12composer

symfony mailjet-mailerRange6.4.0–6.4.40composer

symfony symfonyRange8.0.0–8.0.12composer

symfony symfonyRange7.0.0–7.4.12composer

symfony symfonyRange6.4.0–6.4.40composer

symfony lox24-notifierRange8.0.0–8.0.12composer

symfony lox24-notifierRange7.1.0–7.4.12composer

Source	Link
github	www.github.com/symfony/symfony/security/advisories/GHSA-64hg-93w9-fc35
github	www.github.com/symfony/symfony/commit/4aaa45dd054f73445f1ab254968b7e60b546cc77
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/lox24-notifier/CVE-2026-45754.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/mailjet-mailer/CVE-2026-45754.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45754.yaml
symfony	www.symfony.com/cve-2026-45754
github	www.github.com/advisories/GHSA-64hg-93w9-fc35

28 May 2026 17:22Current

5.7Medium risk

Vulners AI Score5.7

EPSS0.00103